Service Creation

The registration of a new service or daemon on an operating system.

Data Collection Measures:

• Windows Event Logs
  • Event ID 4697 - Captures the creation of a new Windows service.
  • Event ID 7045 - Captures services installed by administrators or adversaries.
  • Event ID 7034 - Could indicate malicious service modification or exploitation.
• Sysmon Logs
  • Sysmon Event ID 1 - Process Creation (captures service executables).
  • Sysmon Event ID 4 - Service state changes (detects service installation).
  • Sysmon Event ID 13 - Registry modifications (captures service persistence changes).
• PowerShell Logging
  • Monitor New-Service and Set-Service PowerShell cmdlets in Event ID 4104 (Script Block Logging).
• Linux/macOS Collection Methods
  • AuditD & Syslog Daemon Logs (/var/log/syslog, /var/log/messages, /var/log/daemon.log)
  • AuditD Rules:
    • auditctl -w /etc/systemd/system -p wa -k service_creation
    • Detects changes to systemd service configurations.
• Systemd Journals (journalctl -u <service_name>)
  • Captures newly created systemd services.
• LaunchDaemons & LaunchAgents (macOS)
  • Monitor /Library/LaunchDaemons/ and /Library/LaunchAgents/ for new plist files.